TI-2024-22996 Aliases CVE-2024-34697

Freescout vulnerable to Stored HTML Injection in Editing Received Emails

HIGH 66CWE-74Published 2024-05-13 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Freescout Application. The vulnerability allows attackers to inject malicious HTML content into emails sent to the application's mailbox. This vulnerability arises from improper handling of HTML content within incoming emails, allowing attackers to embed malicious HTML code in the context of the application's domain. Unauthenticated attackers can exploit this vulnerability to inject malicious HTML content into emails. This could lead to various attacks such as form hijacking, application defacement, or data exfiltration via CSS injection. Although unauthenticated attackers are limited to HTML injection, the consequences can still be severe. Version 1.8.139 implements strict input validation and sanitization mechanisms to ensure that any HTML content received via emails is properly sanitized to prevent malicious HTML injections.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00575 47th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed freescout (freescout-helpdesk): 1.8.139

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
freescout-help-desk	freescout	before 1.8.139	1.8.139	Patch available	CNA

freescout Vendorfreescout-help-desk Affected before 1.8.139 Fixed in 1.8.139 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:freescout:freescout::::::::	before 1.8.139	Vulnerable	freescout-help-desk

cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions before 1.8.139 Vulnerable ·freescout-help-desk

Remediation

Fix · CNA freescout (freescout-helpdesk) Fixed in 1.8.139

Timeline

2026-10-02 Threatist record created from CVE-2024-34697

References

Exploit 1

https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-985r-6qfc-hg8m

Patch 1

https://github.com/freescout-helpdesk/freescout/commit/99a4b4b4e153c82e273e549b9efbf6db4a2d8328

TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
TI-2026-25245 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) CVSS 3.1CRITICAL 9.3
TI-2026-22596 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
TI-2024-19354 FreeScout OS Command Injection vulnerability CVSS 3.1CRITICAL 9.1

See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences